{"id":91574,"date":"2020-08-14T19:42:27","date_gmt":"2020-08-14T17:42:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec"},"modified":"2020-08-14T19:42:27","modified_gmt":"2020-08-14T17:42:27","slug":"skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","title":{"rendered":"Thyerja e fshihet e fjal\u00ebkalimeve me Smbexec","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Thyerja
\n
\nNe shkrim rregullisht p\u00ebr m\u00ebnyrat si haker\u00ebt shpesh mb\u00ebshteten n\u00eb p\u00ebrdorimin metodave t\u00eb hackimit pa kod t\u00eb d\u00ebmsh\u00ebm<\/a><\/noindex>, p\u00ebr t\u00eb shmangur zbulimin. Ata n\u00eb m\u00ebnyr\u00eb dosido \"mbijetojn\u00eb nga ushqimi i mbetur\"<\/a><\/noindex>, duke p\u00ebrdorur mjete standarde t\u00eb Windows, duke e anashkaluar k\u00ebshtu antivirus\u00ebt dhe utilitat e tjera t\u00eb zbulimit t\u00eb aktiviteteve t\u00eb d\u00ebmshme. Ne, si mbrojt\u00ebs, tani jemi t\u00eb detyruar t\u00eb p\u00ebrballen me pasojat e trishta t\u00eb k\u00ebtij hacking t\u00eb men\u00e7ur: nj\u00eb punonj\u00ebs i pozicionuar mir\u00eb mund t\u00eb p\u00ebrdor\u00eb qasje t\u00eb nj\u00ebjt\u00eb p\u00ebr t\u00eb vjedhur t\u00eb dh\u00ebna n\u00eb heshtje (pron\u00ebsi intelektuale e kompanis\u00eb, numra kreditore). Dhe n\u00ebse ai nuk nxiton, por punon ngadal\u00eb dhe pa iu b\u00ebr\u00eb zhurm\u00eb, do t\u00eb jet\u00eb jasht\u00ebzakonisht e v\u00ebshtir\u00eb \u2014 por ende e mundur, n\u00ebse p\u00ebrdoret qasja e duhur dhe mjete<\/a><\/noindex>, \u2014 p\u00ebr t\u00eb zbuluar nj\u00eb aktivitet t\u00eb till\u00eb.<\/p>\n

N\u00eb an\u00ebn tjet\u00ebr, nuk do t\u00eb doja t\u00eb demonizoja punonj\u00ebsit, pasi askush nuk d\u00ebshiron t\u00eb punoj\u00eb n\u00eb nj\u00eb mjedis biznesi direkt nga \"1984\" i Orwellit. Fatmir\u00ebsisht, ka nj\u00eb s\u00ebr\u00eb hapash praktik\u00eb dhe k\u00ebshillash q\u00eb mund t\u00eb komplikohet ndjesh\u00ebm jeta e insajder\u00ebve. Ne do t\u00eb shqyrtojm\u00eb metodat e fshehta t\u00eb sulmit<\/strong>, t\u00eb p\u00ebrdorura nga haker\u00ebt e punonj\u00ebsve me nj\u00eb far\u00eb backgroundi teknik. M\u00eb tej do t\u00eb diskutojm\u00eb mund\u00ebsit\u00eb p\u00ebr t\u00eb ulur k\u00ebto rreziqe \u2013 do t\u00eb studiojm\u00eb si veprime teknike ashtu edhe organizative.
\n<\/a><\/noindex><\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb e keqe p\u00ebr PsExec?<\/h2>\n

\nEdward Snowden, qoft\u00eb e drejt\u00eb apo e gabuar, \u00ebsht\u00eb b\u00ebr\u00eb sinonim p\u00ebr vjedhjen e t\u00eb dh\u00ebnave nga brenda. P\u00ebr m\u00eb tep\u00ebr, mos harxhoni t\u00eb shikoni k\u00ebt\u00eb artikull <\/a><\/noindex>rreth insajdereve t\u00eb tjer\u00eb, gjithashtu t\u00eb merituar nj\u00ebfar\u00eb statusi njohjeje. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet nj\u00eb pik\u00eb e r\u00ebnd\u00ebsishme p\u00ebr metodat q\u00eb p\u00ebrdori Snowden \u2014 p\u00ebr aq sa dim\u00eb, ai nuk instaloi <\/em>asnj\u00eb softuer t\u00eb d\u00ebmsh\u00ebm t\u00eb jasht\u00ebm!<\/p>\n

P\u00ebrkundrazi, Snowden p\u00ebrdori pak inxhinieri sociale dhe shfryt\u00ebzoi pozitat e tij si administrator sistemi p\u00ebr t\u00eb mbledhur fjal\u00ebkalimet dhe p\u00ebr t\u00eb krijuar kredenciale. Asgj\u00eb e komplikuar \u2013 pa mimikatz<\/a><\/noindex>, sulme man-in-the-middle <\/a><\/noindex>ose metasploit<\/a><\/noindex>. <\/p>\n

Punonj\u00ebsit e organizatave nuk jan\u00eb gjithmon\u00eb n\u00eb nj\u00eb pozitat unike si Snowden, por nga koncepti \"mbijetimi nga ushqimi i mbetur\" mund t\u00eb nxirret nj\u00eb s\u00ebr\u00eb m\u00ebsimesh q\u00eb duhet t\u00eb dihen \u2014 mos b\u00ebni ndonj\u00eb veprim t\u00eb d\u00ebmsh\u00ebm q\u00eb mund t\u00eb zbulohet dhe ve\u00e7an\u00ebrisht p\u00ebrdorimi i kujdessh\u00ebm i kredencialeve. Mbani mend k\u00ebt\u00eb mendim.<\/p>\n

Psexec<\/a><\/noindex> dhe kush\u00ebriri i tij crackmapexec <\/a><\/noindex>b\u00ebn\u00eb p\u00ebrshtypje p\u00ebr nj\u00eb num\u00ebr t\u00eb madh pentester\u00ebsh, haker\u00ebsh dhe bloger\u00ebsh n\u00eb sigurin\u00eb informatike. Dhe n\u00eb kombinim me mimikatz, psexec i lejon sulmuesit t\u00eb l\u00ebvizin brenda rrjetit pa pasur nevoj\u00eb t\u00eb din\u00eb fjal\u00ebkalimin n\u00eb form\u00ebn e hapur. <\/p>\n

Mimikatz kap NTLM-hashin n\u00eb procesin LSASS dhe m\u00eb pas transferon tokenin ose kredencialet \u2013 t\u00eb njohura si sulmi 'pass the hash'<\/strong> \u2013 n\u00eb psexec, duke i lejuar sulmuesit t\u00eb hyj\u00eb n\u00eb nj\u00eb server tjet\u00ebr n\u00eb emrin e nj\u00eb <\/em>p\u00ebrdoruesi tjet\u00ebr. Dhe me \u00e7do l\u00ebvizje n\u00eb nj\u00eb server t\u00eb ri, sulmuesi grumbullon kredenciale shtes\u00eb, duke zgjeruar mund\u00ebsit\u00eb e tij n\u00eb k\u00ebrkimin e p\u00ebrmbajtjes s\u00eb disponueshme.<\/p>\n

Kur fillova t\u00eb punoja me psexec, m\u00eb dukej thjesht magjik \u2013 faleminderit Mark Russinovich<\/a><\/noindex>, zhvilluesit t\u00eb gjenial t\u00eb psexec, \u2013 por un\u00eb gjithashtu e di p\u00ebr komponent\u00ebt e tij <\/em>m\u00eb t\u00eb zhurmsh\u00ebm. Ai nuk \u00ebsht\u00eb aspak i fsheht\u00eb! <\/p>\n

Fakti i par\u00eb interesant rreth psexec \u00ebsht\u00eb se ai p\u00ebrdor nj\u00eb protokoll t\u00eb avancuar SMB t\u00eb rrjetit <\/strong>nga Microsoft. Me an\u00eb t\u00eb SMB, psexec transferon skedar\u00eb t\u00eb vegj\u00ebl binary <\/em>n\u00eb sistemin e synuar, duke i vendosur ato n\u00eb dosjen C:Windows.<\/p>\n

Pastaj psexec krijon nj\u00eb sh\u00ebrbim Windows duke p\u00ebrdorur binarin e kopjuar dhe e aktivizon at\u00eb me nj\u00eb em\u00ebr krejt\u00ebsisht 'p\u00ebr t\u00eb papritur' PSEXECSVC. N\u00eb k\u00ebt\u00eb moment, mund ta shihni gjith\u00e7ka, si\u00e7 b\u00ebj un\u00eb, duke v\u00ebzhguar makin\u00ebn e larg\u00ebt (shih m\u00eb posht\u00eb).<\/p>\n

\"Thyerja<\/p>\n

Vizit karta e Psexec: sh\u00ebrbimi 'PSEXECSVC'. Ai aktivizon skedarin binar q\u00eb \u00ebsht\u00eb vendosur p\u00ebrmes SMB n\u00eb dosjen C:Windows.<\/em><\/p>\n

\nSi nj\u00eb faz\u00eb p\u00ebrfundimtare, skedari binar i kopjuar hap nj\u00eb lidhje RPC<\/em> me serverin e synuar dhe m\u00eb pas pranon komandat e menaxhimit (duke p\u00ebrfshir\u00eb si parazgjedhje \u2013 p\u00ebrmes shkel\u00ebsit cmd t\u00eb Windows), duke i aktivizuar ato dhe duke drejtuar hyrjen dhe daljen n\u00eb makin\u00ebn e sulmuesit. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, sulmuesi sheh nj\u00eb komand\u00eb t\u00eb thjesht\u00eb \u2013 e nj\u00ebjt\u00eb si n\u00ebse do t\u00eb ishte lidhur drejtp\u00ebrdrejt. <\/p>\n

Shum\u00eb komponent\u00eb dhe nj\u00eb proces shum\u00eb zhurmsh\u00ebm!<\/p>\n

Mekanizmi kompleks i proceseve t\u00eb brendshme t\u00eb psexec shpjegon mesazhin q\u00eb m\u00eb ngat\u00ebrroi gjat\u00eb testeve t\u00eb mia t\u00eb para disa vitesh: 'Duke nisur PSEXECSVC...,' dhe pauz\u00ebn q\u00eb pasoi p\u00ebrpara shfaqjes s\u00eb komand\u00ebs. <\/p>\n

\"Thyerja<\/p>\n

Psexec nga Impacket n\u00eb t\u00eb v\u00ebrtet\u00eb tregon se \u00e7far\u00eb ndodh 'n\u00ebn kapak'.<\/em><\/p>\n

\nNuk \u00ebsht\u00eb e habitshme: psexec ka b\u00ebr\u00eb nj\u00eb sasi t\u00eb madhe pune \"n\u00ebn kapak\". N\u00ebse jeni t\u00eb interesuar p\u00ebr nj\u00eb shpjegim m\u00eb t\u00eb detajuar, shikoni k\u00ebtu <\/a><\/noindex>me k\u00ebt\u00eb p\u00ebrshkrim t\u00eb mrekulluesh\u00ebm.<\/p>\n

E qart\u00eb, q\u00eb kur p\u00ebrdoret si nj\u00eb mjet administrimi sistemi, q\u00eb ishte q\u00ebllimi fillestar <\/em>i psexec, nuk ka asgj\u00eb t\u00eb keqe p\u00ebr \"z buzzing\" t\u00eb t\u00eb gjith\u00eb k\u00ebtyre mekanizmave t\u00eb Windows. Megjithat\u00eb, p\u00ebr nj\u00eb sulmues, psexec do t\u00eb krijoj\u00eb komplikime, dhe p\u00ebr nj\u00eb insider t\u00eb kujdessh\u00ebm dhe t\u00eb zgjuar, si Snowden, psexec ose nj\u00eb utilitar i ngjash\u00ebm do t\u00eb jet\u00eb nj\u00eb rrezik shum\u00eb i madh.<\/p>\n

Dhe at\u00ebher\u00eb vjen Smbexec<\/h2>\n

\nSMB \u00ebsht\u00eb nj\u00eb m\u00ebnyr\u00eb e zgjuar dhe e fsheht\u00eb p\u00ebr t\u00eb transfertuar skedar\u00eb midis server\u00ebve, dhe hakerat jan\u00eb futur drejtp\u00ebrdrejt n\u00eb SMB p\u00ebr shum\u00eb koh\u00eb. Mendoj se t\u00eb gjith\u00eb e din\u00eb se nuk duhet t\u00eb hapin <\/a><\/noindex>portat SMB 445 dhe 139 n\u00eb internet, apo jo?<\/p>\n

N\u00eb vitin 2013, n\u00eb Defcon, Erik Milman (brav0hax<\/a><\/noindex>) e prezantoi smbexec<\/a><\/noindex>, n\u00eb m\u00ebnyr\u00eb q\u00eb tester\u00ebt e penetrimit t\u00eb mund t\u00eb provonin hackimin e fsheht\u00eb t\u00eb SMB. Nuk e di t\u00ebr\u00eb historin\u00eb, por m\u00eb pas Impacket e p\u00ebrmir\u00ebsoi m\u00eb tej smbexec. N\u00eb t\u00eb v\u00ebrtet\u00eb, p\u00ebr testimin tim kam shkarkuar skiptet nga Impacket n\u00eb Python nga Github<\/a><\/noindex>.<\/p>\n

Ndryshe nga psexec, smbexec eviton <\/em>transferimin e nj\u00eb skedari binar potencialisht t\u00eb d detectable n\u00eb makin\u00ebn e synuar. N\u00eb vend t\u00eb k\u00ebsaj, utilitari jeton plot\u00ebsisht me \"burime\" p\u00ebrmes ekzekutimit t\u00eb komand\u00ebs<\/em> lokale t\u00eb Windows.<\/p>\n

K\u00ebto jan\u00eb ato q\u00eb b\u00ebn: d\u00ebrgon nj\u00eb komand\u00eb nga makina sulmuese p\u00ebrmes SMB n\u00eb nj\u00eb skedar t\u00eb ve\u00e7ant\u00eb t\u00eb pranuar, dhe m\u00eb pas krijon dhe ekzekuton nj\u00eb komand\u00eb t\u00eb komplikuar (si nj\u00eb sh\u00ebrbim Windows), i cili do t\u00eb duket i njohur p\u00ebr p\u00ebrdoruesit e Linux-it. N\u00eb p\u00ebrmbledhje: ajo ekzekuton shell-in nativ t\u00eb Windows cmd, redirekton daljen n\u00eb nj\u00eb skedar tjet\u00ebr dhe pastaj e d\u00ebrgon at\u00eb p\u00ebrs\u00ebri n\u00eb makin\u00ebn e sulmuesit p\u00ebrmes SMB. <\/p>\n

M\u00ebnyra m\u00eb e mir\u00eb p\u00ebr ta kuptuar k\u00ebt\u00eb \u00ebsht\u00eb t\u00eb studioj komand\u00ebn q\u00eb kam arritur t\u00eb marr nga regjistri i ngjarjeve (shih m\u00eb posht\u00eb).<\/p>\n

\"Thyerja<\/p>\n

Nuk \u00ebsht\u00eb kjo nj\u00eb m\u00ebnyr\u00eb e shk\u00eblqyer p\u00ebr t\u00eb redirigjuar hyrjen\/nd\u00ebrprerjen? Ngjitur me k\u00ebt\u00eb, krijimi i sh\u00ebrbimit ka ID-n\u00eb e ngjarjes 7045.<\/em><\/p>\n

\nAshtu si psexec, ajo gjithashtu krijon nj\u00eb sh\u00ebrbim q\u00eb b\u00ebn t\u00eb gjith\u00eb pun\u00ebn, por sh\u00ebrbimi pas k\u00ebsaj hiqet<\/em> p\u00ebrdoret vet\u00ebm nj\u00eb her\u00eb p\u00ebr t\u00eb ekzekutuar komand\u00ebn dhe pastaj zhduket! Nj\u00eb punonj\u00ebs i siguris\u00eb informacionit, q\u00eb po v\u00ebzhgon makin\u00ebn e viktim\u00ebs, nuk do t\u00eb jet\u00eb n\u00eb gjendje t\u00eb zbuloj\u00eb kompromiset e dukshme <\/em>indikator\u00ebt e sulmit: nuk ka ndonj\u00eb skedar t\u00eb d\u00ebmsh\u00ebm t\u00eb ekzekutuesh\u00ebm, nuk instalohet ndonj\u00eb sh\u00ebrbim i p\u00ebrhersh\u00ebm dhe nuk ka prova t\u00eb p\u00ebrdorimit t\u00eb RPC, pasi SMB \u00ebsht\u00eb mjeti i vet\u00ebm i transferimit t\u00eb t\u00eb dh\u00ebnave. Gjenial!<\/p>\n

Nga ana e sulmuesit, \u00ebsht\u00eb e disponueshme nj\u00eb \"pseudo-shell\" me vonesa midis d\u00ebrgimit t\u00eb komand\u00ebs dhe marrjes s\u00eb p\u00ebrgjigjes. Por kjo \u00ebsht\u00eb e mjaftueshme p\u00ebr veprimin e keqb\u00ebr\u00ebsit \u2013 qofshin ata nj\u00eb brend\u00ebsor, apo nj\u00eb haker i jasht\u00ebm q\u00eb tashm\u00eb ka nj\u00eb pikat e mb\u00ebshtetjes \u2013 p\u00ebr t\u00eb filluar t\u00eb k\u00ebrkoj\u00eb p\u00ebr p\u00ebrmbajtje interesante.<\/p>\n

\"Thyerja
\n
\nP\u00ebr t\u00eb d\u00ebrguar t\u00eb dh\u00ebna p\u00ebrs\u00ebri nga makina e synuar n\u00eb makin\u00ebn e keqb\u00ebr\u00ebsit, p\u00ebrdoret smbclient<\/a><\/noindex>. Po, kjo \u00ebsht\u00eb ajo Samba nj\u00ebsia<\/a><\/noindex>, por vet\u00ebm e rregulluar p\u00ebr skriptin Python t\u00eb Impacket. N\u00eb fakt, smbclient ju lejon t\u00eb organizoni fshehtazi transferimin e FTP mbi SMB.<\/p>\n

Le t\u00eb b\u00ebjm\u00eb nj\u00eb hap pas dhe t\u00eb mendojm\u00eb mbi at\u00eb q\u00eb kjo mund t\u00eb sjell\u00eb p\u00ebr punonj\u00ebsin. N\u00eb skenarin tim t\u00eb shpikur, le t\u00eb themi se nj\u00eb bloger, analist financiar ose nj\u00eb k\u00ebshilltar me pag\u00eb t\u00eb lart\u00eb \u00ebsht\u00eb i autorizuar t\u00eb p\u00ebrdor\u00eb laptopin e tij personal p\u00ebr pun\u00eb. Si rezultat i nj\u00eb procesi magjik, ajo ofendon kompanin\u00eb dhe \"hedh n\u00eb ngritje\". N\u00eb var\u00ebsi t\u00eb sistemit operativ t\u00eb laptopit, ajo ose p\u00ebrdor versionin e Python nga Impact, ose versionin Windows t\u00eb smbexec ose smbclient si nj\u00eb skedar .exe.<\/p>\n

Si Snowden, ajo m\u00ebson fjal\u00ebkalimin e nj\u00eb p\u00ebrdoruesi tjet\u00ebr duke e par\u00eb at\u00eb nga pas shpatull\u00ebs, ose i ndodh fatit dhe gjen nj\u00eb skedar tekstual me fjal\u00ebkalimin. Dhe me k\u00ebto akreditive, ajo fillon t\u00eb shfletoj\u00eb n\u00eb sistem n\u00eb nj\u00eb nivel tjet\u00ebr t\u00eb privilegjeve. <\/p>\n

Hacking DCC: nuk na nevojitet asnj\u00eb \"budallall\u00ebk\" Mimikatz<\/h2>\n

\nN\u00eb postimet e mia t\u00eb m\u00ebparshme, q\u00eb i kushtohen testimit t\u00eb penetrimit, un\u00eb kam p\u00ebrdorur shum\u00eb shpesh mimikatz. Kjo \u00ebsht\u00eb nj\u00eb mjet fantastik p\u00ebr kapjen e akrediteve \u2013 hash-eve NTLM dhe madje edhe fjal\u00ebkalimeve n\u00eb form\u00eb t\u00eb hapur, q\u00eb jan\u00eb fshehur brenda laptop\u00ebve dhe presin vet\u00ebm q\u00eb t\u00eb p\u00ebrdoren.
\nKoha kan\u00eb ndryshuar. Mjetet e monitorimit jan\u00eb p\u00ebrmir\u00ebsuar n\u00eb deteccionin dhe bllokimin e mimikatz. Administrator\u00ebt e siguris\u00eb s\u00eb informacionit gjithashtu kan\u00eb m\u00eb shum\u00eb mund\u00ebsi p\u00ebr t\u00eb reduktuar rreziqet e lidhura me sulmet e tipit \"pass the hash\" (m\u00eb pas \u2013 PtH).
\nPrandaj, \u00e7far\u00eb duhet t\u00eb b\u00ebj\u00eb nj\u00eb punonj\u00ebs i zgjuar p\u00ebr t\u00eb mbledhur akredite t\u00eb tjera pa p\u00ebrdorur mimikatz?<\/p>\n

N\u00eb paket\u00ebn nga Impacket \u00ebsht\u00eb nj\u00eb mjet i quajtur secretsdump<\/a><\/noindex>, i cili nxjerr kredencialet nga cache Domain Credential Cache, ose shkurt DCC. Sa kuptoj, n\u00ebse nj\u00eb p\u00ebrdorues i domain-it hyn n\u00eb server, por controller-i i domain-it nuk \u00ebsht\u00eb i disponuesh\u00ebm, DCC-i lejon serverin t\u00eb autentifikoj\u00eb p\u00ebrdoruesin. N\u00eb \u00e7do rast, secretsdump ju lejon t\u00eb nxirrni t\u00eb gjitha k\u00ebto hash-e, n\u00ebse ato jan\u00eb t\u00eb disponueshme.<\/p>\n

Hash-et DCC jan\u00eb jo NTLM hash-e <\/em> dhe problemet e tyre nuk mund t\u00eb p\u00ebrdoren p\u00ebr sulm PtH<\/em>.<\/p>\n

Megjithat\u00eb, mund t\u00eb provoni t\u2019i thyenit p\u00ebr t\u00eb marr\u00eb fjal\u00ebkalimin origjinal. Sidomos tani, Microsoft \u00ebsht\u00eb b\u00ebr\u00eb m\u00eb e men\u00e7ur me DCC dhe thyerja e hash-eve DCC \u00ebsht\u00eb b\u00ebr\u00eb jasht\u00ebzakonisht e v\u00ebshtir\u00eb. Po, ekziston hashcat<\/a><\/noindex>, \"thyer\u00ebsi m\u00eb i shpejt\u00eb n\u00eb bot\u00eb\", por ai k\u00ebrkon nj\u00eb GPU p\u00ebr t\u00eb funksionuar me efikasitet.<\/p>\n

N\u00eb vend t\u00eb k\u00ebsaj, le t\u00eb mendojm\u00eb si Snowden. Nj\u00eb punonj\u00ebs mund t\u00eb kryej\u00eb inxhinieri sociale dhe ndoshta t\u00eb zbuloj\u00eb ndonj\u00eb informacion rreth personit, fjal\u00ebkalimi i t\u00eb cilit d\u00ebshiron t\u00eb thyej\u00eb. P\u00ebr shembull, t\u00eb zbuloj\u00eb n\u00ebse ndonj\u00ebher\u00eb \u00ebsht\u00eb thyer llogaria online e k\u00ebtij personi dhe t\u00eb studioj\u00eb fjal\u00ebkalimin e tij n\u00eb tekst t\u00eb hapur p\u00ebr ndonj\u00eb sugjerim. <\/p>\n

Dhe ky \u00ebsht\u00eb skenari q\u00eb vendosa t\u00eb ndjek. Le t\u00eb supozojm\u00eb se nj\u00eb insajder ka m\u00ebsuar se shefi i tij, Cruella, \u00ebsht\u00eb thyer disa her\u00eb n\u00eb disa faqe. Pas analizimit t\u00eb disa nga k\u00ebto fjal\u00ebkalime, ai kupton se Cruella preferon t\u00eb p\u00ebrdor\u00eb formatin e emrit t\u00eb ekipit t\u00eb bejzbollit \"Yankees\" dhe vitin n\u00eb vazhdim \u2013 \"Yankees2015\".<\/p>\n

N\u00ebse po p\u00ebrpiqeni ta riprodhoni k\u00ebt\u00eb n\u00eb sht\u00ebpi tani, mund t\u00eb shkarkoni nj\u00eb t\u00eb vog\u00ebl, \"C\" kod<\/a><\/noindex>, q\u00eb implementon algoritmin e hash-it DCC, dhe ta kompilon at\u00eb. John the Ripper<\/a><\/noindex>, p\u00ebr shembull, ka shtuar mb\u00ebshtetje p\u00ebr DCC, k\u00ebshtu q\u00eb mund t\u00eb p\u00ebrdoret gjithashtu. Le t\u00eb supozojm\u00eb se insajderi nuk do t\u00eb mundohet t\u00eb studioj\u00eb John the Ripper dhe preferon t\u00eb drejtoj\u00eb \"gcc\" n\u00eb kodin C t\u00eb vjet\u00ebruar.<\/p>\n

Duke luajtur rolin e insajderit, kam p\u00ebrdorur disa kombinime t\u00eb ndryshme dhe p\u00ebrfundimisht arrita t\u00eb zbuloj se fjal\u00ebkalimi i Cruella-s \u00ebsht\u00eb \"Yankees2019\" (shih m\u00eb posht\u00eb). Misioni \u00ebsht\u00eb p\u00ebrfunduar!<\/p>\n

\"Thyerja<\/p>\n

Pak inxhinieri sociale, nj\u00eb doz\u00eb ende t\u00eb konsiderueshme dhe nj\u00eb maj\u00eb Maltego \u2013 dhe tashm\u00eb jeni n\u00eb rrug\u00ebn p\u00ebr t\u00eb thyer hash-in DCC.<\/em><\/p>\n

Propozoj t\u00eb ndalojm\u00eb k\u00ebtu. Do t\u00eb rikthehemi n\u00eb k\u00ebt\u00eb tem\u00eb n\u00eb publikime t\u00eb tjera dhe do t\u00eb shqyrtojm\u00eb edhe m\u00eb shum\u00eb metoda t\u00eb ngadalta dhe t\u00eb fshehta sulmi, duke vazhduar t\u00eb mb\u00ebshtetemi n\u00eb grupin e shk\u00eblqyer t\u00eb mjeteve nga Impacket.
\n
Burimi: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u044b \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0438\u0448\u0435\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0447\u0430\u0441\u0442\u043e \u043e\u043f\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430 \u0431\u0435\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041e\u043d\u0438 \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u00ab\u0432\u044b\u0436\u0438\u0432\u0430\u044e\u0442 \u043d\u0430 \u043f\u043e\u0434\u043d\u043e\u0436\u043d\u043e\u043c \u043a\u043e\u0440\u043c\u0443\u00bb, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 Windows, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u043e\u0431\u0445\u043e\u0434\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u041c\u044b, \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0438, \u0442\u0435\u043f\u0435\u0440\u044c \u0432\u044b\u043d\u0443\u0436\u0434\u0435\u043d\u044b \u0438\u043c\u0435\u0442\u044c \u0434\u0435\u043b\u043e \u0441 \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f\u043c\u0438 \u0442\u0430\u043a\u0438\u0445 \u0445\u0438\u0442\u0440\u044b\u0445 \u0442\u0435\u0445\u043d\u0438\u043a \u0432\u0437\u043b\u043e\u043c\u0430: \u0443\u0434\u0430\u0447\u043d\u043e \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91575,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91574","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hacking i fjal\u00ebve kaluese me Smbexec | ProHoster","description":"Ne shkruajm\u00eb rregullisht p\u00ebr at\u00eb si hakerat shpesh.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u0437\u043b\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Smbexec | ProHoster","og:description":"\u041c\u044b \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0438\u0448\u0435\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0447\u0430\u0441\u0442\u043e.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-14T17:42:27+00:00","article:modified_time":"2020-08-14T17:42:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91574","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:25:22","updated":"2022-09-28 07:05:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=91574"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91574\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/91575"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=91574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=91574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=91574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}